"Enrolled hosts" chart doesn't exclude pending hosts

[kc9wwh]

Fleet versions

• Discovered: v4.87.0
• Reproduced: v4.87.1

Web browser and operating system: N/A

---

💥 Actual behavior

The "Enrolled hosts" chart on the Hosts page includes pending hosts in its per-platform counts. Hovering over a platform (e.g., macOS) and drilling into the filtered host list does not exclude pending hosts.

🛠️ Expected behavior

Hovering over a platform in the "Enrolled hosts" chart should show the count of enrolled (non-pending) hosts for that platform, and drilling in should link to a filtered list that excludes pending hosts.

🧑‍💻 Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. In a Fleet instance with MDM enabled, enroll a batch of hosts via automatic enrollment (e.g., ADE) so a subset remain in "Pending" status.
2. Navigate to the Hosts page and view the "Enrolled hosts" chart.
3. Hover over a platform (e.g., macOS) to see its host count, then drill into the filtered list.
4. Observe that pending hosts are included in both the count and the filtered list, rather than excluded.

🕯️ More info (optional)

Re: #44647

---

Engineering notes

Root cause: In server/datastore/mysql/hosts.go, the GenerateHostStatusStatistics() function has two queries. The summary statistics query (total/mia/missing counts) correctly joins host_mdm and filters out enrollment_status = 'Pending'. The platform breakdown query (which feeds the "Enrolled hosts" chart) does NOT -- it counts all rows in hosts grouped by platform with no pending filter.

Fix: Add a LEFT JOIN host_mdm hmdm ON h.id = hmdm.host_id and a WHERE (hmdm.enrollment_status IS NULL OR hmdm.enrollment_status != 'Pending') clause to the platform breakdown query in GenerateHostStatusStatistics(), matching the pattern already used by the summary stats query in the same function.

Testing:

• Enroll hosts via ADE so some remain in Pending status
• Verify the "Enrolled hosts" chart counts exclude pending hosts
• Verify drill-down filtered list also excludes pending hosts
• Verify the "Total hosts" card still includes pending hosts (intentional per product decision)

[kc9wwh]

@sharon-fdm, requesting p2 label. Was brought up during panoramix fast-track and causing some additional frustration with having to do math to identify hosts enrolled vs still pending.

[sharon-fdm]

@kc9wwh , P2 approved and will be taken per the process.